CVE-2022-36129
📋 TL;DR
HashiCorp Vault Enterprise clusters using Integrated Storage expose an unauthenticated API endpoint that allows attackers to override a node's voter status in HA clusters. This could lead to cluster instability, data loss, or catastrophic failure. Affects Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0.
💻 Affected Systems
- HashiCorp Vault Enterprise
📦 What is this software?
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Complete cluster failure leading to data loss, service disruption, and potential compromise of all secrets stored in Vault.
Likely Case
Cluster instability, degraded performance, and potential data inconsistency across nodes.
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent access to the vulnerable endpoint.
🎯 Exploit Status
Exploitation requires network access to the vulnerable API endpoint but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.8, 1.10.5, and 1.11.1
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420
Restart Required: Yes
Instructions:
1. Backup Vault data and configuration. 2. Upgrade to Vault Enterprise 1.9.8, 1.10.5, or 1.11.1. 3. Restart Vault services. 4. Verify cluster health and voter status.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to Vault API endpoints to trusted sources only.
iptables -A INPUT -p tcp --dport 8200 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p tcp --dport 8200 -j DROP
🧯 If You Can't Patch
- Implement strict network ACLs to limit access to Vault API endpoints
- Monitor cluster logs for unauthorized voter status changes
🔍 How to Verify
Check if Vulnerable:
Check Vault version with 'vault version' command and verify if using affected versions with Integrated Storage HA.Check Version:
vault versionVerify Fix Applied:
Verify version is 1.9.8, 1.10.5, or 1.11.1 and test cluster stability after patch.📡 Detection & Monitoring
Log Indicators:
- Unexpected voter status changes in cluster logs
- Unauthorized API calls to voter status endpoints
Network Indicators:
- Unusual traffic to Vault API port 8200 from untrusted sources
SIEM Query:
source="vault" AND ("voter status" OR "cluster join")🔗 References
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420
- https://security.netapp.com/advisory/ntap-20220901-0011/
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420
- https://security.netapp.com/advisory/ntap-20220901-0011/
